sso -> hiera role; explicitly include apache2